Additional  Copies 


To  obtain  additional  copies  of  this  audit  report,  contact  the  Secondary  Reports 
Distribution  Unit  of  the  Analysis,  Planning,  and  Technical  Support  Directorate  at 
(703)  604-8937  (DSN  664-8937)  or  FAX  (703)  604-8932. 

Suggestions  for  Future  Audits 

To  suggest  ideas  for  or  to  request  future  audits,  contact  the  Planning  and  Coordination 
Branch  of  the  Analysis,  Planning,  and  Technical  Support  Directorate  at  (703)  604-8908 
(DSN  664-8908)  or  FAX  (703)  604-8932.  Ideas  and  requests  can  also  be  mailed  to: 

OAIG-AUD  (ATTN:  APTS  Audit  Suggestions) 

Inspector  General,  Department  of  Defense 
400  Army  Navy  Drive  (Room  801) 

Arlington,  Virginia  22202-2884 

Defense  Hotline 

To  report  fraud,  waste,  or  abuse,  contact  the  Defense  Hotline  by  calling 
(800)  424-9098;  by  sending  an  electronic  message  to  Hotline@I)ODIG.OSD.MIL;  or 
by  writing  to  the  Defense  Hotline,  The  Pentagon,  Washington,  D.C.  20301-1900.  The 
identity  of  each  writer  and  caller  is  fully  protected. 


Acronyms 

FAR  Federal  Acquisition  Regulation 

GAO  General  Accounting  Office 

GSA  General  Services  Administration 

Y2K  Year  2000 


INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON.  VIRGINIA  22202-2884 


Febraary  6,  1998 

MEMORANDUM  FOR  UNDER  SECRETARY  OF  DEFENSE  FOR  ACQUISITION 

AND  TECHNOLOGY 

ASSISTANT  SECRETARY  OF  DEFENSE  (COMMAND, 
CONTROL,  COMMUNICATIONS,  AND 
TNTFT  T  TGFNCE^ 

ASSISTANT  SECRETARY  OF  THE  NAVY 
(nNANCIAL  MANAGEMENT  AND 
COMPTROLLER) 

ASSISTANT  SECRETARY  OF  THE  AIR  FORCE 
(FINANCIAL  MANAGEMENT  AND 
COMPTROLLER) 
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SUBJECT:  Audit  Report  on  DoD  Information  Technology  Solicitations  and  Contract 
Compliance  for  Year  2000  Requirements  (Report  No.  98-065) 


We  are  providing  this  audit  report  for  information  and  use.  Because 
management  has  promptly  taken  action  to  address  the  problems  identified  by  the  audit, 
this  report  contains  no  additional  recommendations. 

Management  comments  on  a  draft  of  the  report  were  considered  in  preparing 
this  report.  Additional  comments  are  not  required. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  If  you  have  questions 
on  the  audit,  please  contact  Mr.  Robert  M.  Murrell,  Audit  Program  Director,  at 
(703)  604-9210  (DSN  664-9210)  email  <  rmurrell@dodig.osd.mil >  or  Mr.  Kent  E. 
Shaw,  Audit  Project  Manager,  at  (703)  604-9228  (DSN  664-9228) 
email  < kshaw@dodig.osd.mil  >.  See  Appendix  F  for  the  report  distribution.  The 
audit  team  members  are  listed  inside  the  back  cover. 

Robert  L.  Lieberman 
Assistant  Inspector  General 
for  Audit 
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DoD  Information  Technology  Solicitations  and 
Contract  Compliance  for  Year  2000  Requirements 

Executive  Summary 


Introduction.  This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General, 
DoD  in  informal  partnership  with  the  Chief  Information  Officer,  DoD  to  monitor  DoD 
efforts  to  address  the  Year  2000  computing  problem.  For  a  listing  of  audit  projects 
addressing  this  issue,  see  the  Year  2000  webpage  on  IGnet*  <htq)://www.ignet.gov> . 

DoD  spends  about  $10  billion  each  year  on  computer  hardware  and  software  and  has 
identified  3,143  mission-critical  systems,  as  of  November  15,  1997,  that  may  be 
affected  by  the  Year  20(K)  problem.  The  problem  arises  because  most  hardware 
operating  systems  and  application  software  packages  produced  over  the  past  20  years 
were  designed  to  use  only  two  digits  to  specify  the  year,  rather  than  four  digits.  The 
use  of  two  digits  rather  than  four  digits  became  industry  practice  to  reduce  memory  and 
disk  space  requirements  during  a  time  when  both  memoty  and  disk  space  were 
expensive  resources.  However,  once  the  year  2000  begins  computers  using  the  two 
digits  design  will  be  unable  to  correctly  interpret  the  year.  The  correction  of  that 
design  flaw  will  pose  a  unique  challenge  to  both  industry  and  Government  and  will 
require  changes  to  existing  and  new  computer  hardware  and  software. 

The  DoD  initiated  actions  to  address  the  new  procurement  aspect  of  the  Year  2000 
issue  in  mid-1996  in  an  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  memorandum,  “Year  2000  Computing  Problem 
with  Personal  Computers  and  Workstations,”  May  8,  1996.  Federal  Acquisition 
Regulation  section  39.106,  “Year  2(XX)  Compliance,”  subsequently  provided 
mandatory  guidance  to  assist  agencies  in  acquiring  information  technology  products  and 
systems  that  are  Year  2(XX)  compliant.  On  January  9,  1997,  the  Office  of  Management 
and  Budget  issued  a  memorandum  to  each  agency  Chief  Information  Officer  and  Senior 
Procurement  Executive,  informing  them  of  die  procurement  guidance  that  was 
developed  for  inclusion  in  the  Federal  Acquisition  Regulation. 


Audit  Objectives.  The  audit  objective  was  to  determine  whether  DoD  information 
technology  solicitations  and  contracts  comply  with  Federal  Acquisition  Regulation 


‘  IGnet  is  an  internet  site  operated  by  the  Inspector  General  Community.  The 
Inspector  General  Community  consists  of  me  Offices  of  Inspector  General  in 
more  than  60  Federal  agencies,  as  well  as  their  peers  in  state  and  local 
government,  education,  nonprofit  organizations,  and  the  private  sector. 


section  39.106,  “Year  2000  Compliance,”  and  to  determine  whether  selected 
information  technology  acquisitions  are,  in  fact.  Year  2000-compliant. 

Audit  Results.  Twenty  of  the  reviewed  35  indefinite-delivery/indefinite-quantity  and 
indefinite-delivery-requirement  information  technology  contracts  (for  commercial  off- 
the-shelf  products)  did  not  have  the  required  Federal  Acquisition  Regulation  Year  2000 
compliance  language,  and  none  of  the  35  contracts  required  testing  of  purchased 
products.  As  a  result,  DoD  has  no  assurance  that  information  technology  products 
purchased  were  Year  2000  compliant.  Further,  the  purchase  of  noncompliant  products 
may  seriously  hamper  the  ability  of  DoD  to  perform  its  administrative  and  warfighting 
mission  requirements.  Additionally,  because  33  of  the  35  contracts  are  available  for 
use  by  other  Federal  agencies,  nonconforming  contract  items  could  negatively  affect  the 
ability  of  the  Federal  government  to  survive  die  Year  2000  crisis.  See  Part  I  for  a 
discussion  of  the  finding. 

Corrective  Actions  Taken  by  Management.  We  briefed  the  Acting  Assistant 
Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence);  the 
Director,  Defense  Procurement;  and  representatives  from  the  Services,  Defense 
Information  Systems  Agency,  and  the  Defense  Intelligence  Agency  on  the  results  of  our 
audit.  Subsequently,  the  Acting  Assistant  Secretary  and  the  Director,  Defense 
Procurement  began  drafting  new  guidance  for  the  Defense  Components  that  would 
require  Year  2000-compliant  information  technology  and  testing  of  items  purchased 
from  the  information  technology  contracts.  We  have  included  final  guidance  resulting 
from  these  efforts  (see  Appendix  F).  Additionally,  Army,  Navy,  and  Air  Force 
Contracting  Officers  completed  the  contract  modifications  to  include  the  required 
Federal  Acquisition  Regulation  Year  2000  language  in  17  additional  contracts  and  three 
other  Air  Force  contracts  are  being  reviewed  (see  Appendix  E).  Because  the  corrective 
actions  taken  or  planned  by  management  should  correct  the  problems  we  identified,  we 
are  making  no  additional  recommendations  in  this  report. 

Management  Comments.  A  draft  of  this  report  was  issued  on  January  15,  1998.  The 
Under  Secretary  of  Defense  for  Acquisition  and  Technology;  the  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence);  the  Services;  and  the 
Defense  Intelligence  Agency  were  invited  to  provide  optional  comments  on  the  draft 
report.  Comments  were  received  from  the  Office  of  Chief  Information  Officer,  Navy 
and  the  Deputy  Assistant  Secretary  (Contracting)  of  the  Offiee  of  the  Assistant 
Secretary  (Acquisition),  Air  Force.  See  Part  I  for  a  summary  of  management 
comments  and  Part  III  for  the  complete  text  of  management  comments. 
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Part  I  -  Audit  Results 


Audit  Background 


Procurement  Guidance  for  Year  2000  Compliance 

Federal  Acquisition  Regulation  (FAR)  section  39.002  defines  “year  2000 
compliant”  information  technology  as  equipment  capable  of  accurately 
processing  date  and  time  data  (calculating,  comparing,  sequencing,  etc.)  in  both 
the  twentieth  and  twenty  first  centuries  as  well  as  leap  years. 

DoD  Guidance.  The  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  issued  a  memorandum,  “Year  2000 
Computing  Problem  with  Personal  Computers  and  Workstations,”  May  8,  1996, 
that  required  immediate  attention  to  the  Year  2000  (Y2K)  computing  problem. 
The  memorandum  required  agencies  to: 

•  determine  whether  contractor  products  are  Y2K  compliant; 

•  issue  stop  work  orders  for  purchase  of  new  products  on  existing 
contracts  if  the  new  products  fail  to  comply  with  Y2K  requirements; 

•  request  contracting  offices  to  develop  a  plan  to  upgrade  their 
products  to  be  Y2K  compliant; 

•  identify  software  and  computer  operations  that  will  be  disrupted  by 
noncompliant  hardware;  and 

•  plan  and  budget  for  corrective  actions. 

FAR  Requirement  for  Y2K  Compliance.  On  January  2,  1997,  interim  FAR 
guidance.  Federal  Acquisition  Circular  90-45,  promulgated  the  requirement  for 
agencies  to  ensure  that  all  solicitations  and  contracts  require  information 
technology  procurements  to  be  or  become  Y2K  compliant  by  December  31, 
1999.  The  General  Services  Administration  finalized  this  interim  guidance  in 
FAR  section  39.106,  “Year  2000  Compliance,”  on  August  22,  1997. 

Office  of  Management  and  Budget.  On  January  9,  1997,  the  Office  of 
Manajgement  and  Budget  distributed  a  memorandum,  “Year  2000  Federal 
Acquisition  Guidance,”  requiring  agency  managers  and  computer  professionals 
to  follow  the  new  FAR  guidance  in  all  agency  information  technology  contracts. 

DoD  Year  2000  Management  Plan,  April  1997.  The  DoD  Year  2000 
Management  Plan  requires  DoD  to  use  Y2K  compliance  language  in  all  new 
contracts  and  modifications  as  appropriate.  It  reiterates  the  need  to  issue  stop 
work  orders  for  new  products  purchased  on  existing  contracts  if  the  products 
fail  to  meet  Y2K  requirements.  Additionally,  the  plan  contains  guidance  for 
software,  to  include  commercial-off-the-shelf  products  and  appropriate 
checklists  to  use  for  determining  Y2K  compliance. 
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The  Year  2000  Problem.  DoD  spends  approximately  $10  billion  each  year  on 
computer  hardware  and  software  and  has  identified  3,143  mission  critical 
systems,  as  of  November  15,  1997,  that  may  be  affected  by  the  Y2K  problem. 
The  problem  arises  because  most  hardware  operating  systems  and  application 
software  packages  produced  over  the  past  20  years  were  designed  to  use  only 
two  digits  rather  than  four  digits  to  specify  the  year.  However,  once  the  year 
2000  begins,  computers  using  the  two-digit  design  will  be  unable  to  correctly 
interpret  the  year.  The  correction  of  that  design  flaw  will  pose  a  unique 
challenge  to  both  industry  and  Government,  and  will  require  changes  to 
computer  hardware  and  software. 

The  Impact  of  the  Y2K  Problem.  DoD  is  using  and  purchasing  an  extensive 
inventory  of  hardware  and  software  that  may  be  affected  by  the  Y2K  problem. 
Desktop  personal  computers  and  client/server  applications  such  as  electronic 
mail,  software,  spreadsheets  and  database  software  that  have  a  date  function  are 
all  susceptible  to  failure  in  the  year  2000.  The  full  impact  of  failure  to  make 
those  required  changes  before  January  1 ,  2000,  may  not  be  known  until  the 
problems  have  already  occurred.  If  die  inability  to  accurately  process  date  and 
time  data  is  not  remedied,  everything  from  missile  systems  to  payroll  systems 
could  be  impacted.  Further,  ignoring  the  Y2K  requirements  in  computer 
systems  could  result  in  great  costs  associated  with  damage  control  and  legal 
liability. 

Management  Controls.  The  Secretary  of  Defense  FY  1997  Management 
Control  Assurance  letter  recognizes  failure  to  proactively  meet  Y2K  compliance 
requirements  as  a  material  control  weakness.  Therefore,  we  did  not  evaluate 
the  management  control  program. 


Audit  Objectives 

The  primary  audit  objective  was  to  determine  whether  DoD  information 
technology  solicitations  and  contracts  comply  with  FAR  section  39.106,  “Year 
2000  Compliance,”  and  to  determine  whether  selected  information  technology 
acquisitions  are,  in  fact,  Y2K  compliant.  See  Appendix  A  for  a  discussion  of 
the  audit  process.  Appendix  B  summarizes  prior  coverage  related  to  the  audit 
objectives. 
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Implementing  Year  2000  Compliance 

Of  the  reviewed  35  indefinite-delivery/indefinite-quantity  and  indefinite- 
delivery-requirement  information  technology  contracts  (for  commercial 
off-the-shelf  products),  20  did  not  contain  the  required  FAR  Y2K 
compliance  language  and  none  of  the  35  contracts  required  testing  of 
purchased  computer  hardware  and  software.  This  lack  of  compliance 
occurred  because  DoD  information  technology  program  managers  and 
contracting  officers  had  not  effectively  implemented  FAR  requirements 
and  DoD  policy  for  Y2K  contract  compliance;  and  the  Chief  Information 
Officer  guidance  for  testing  of  commercial  off  the-shelf  information 
technology  products  was  not  being  followed.  As  a  result,  DoD  has  no 
assurance  that  information  technology  products  offered  or  purchased 
were  Y2K  compliant.  Further,  the  purchase  of  noncompliant  products 
may  seriously  hamper  the  ability  of  DoD  to  perform  its  administrative 
and  warfighting  mission  requirements.  Additionally,  because  33  of  the 
35  contracts  are  available  for  use  by  other  Federal  agencies,  non- 
conforming  contract  items  could  negatively  affect  the  ability  of  the 
Federal  government  to  survive  the  Y2K  crisis. 


Contracts  to  Purchase  Information  Technology  Products 

The  audit  identified  a  significant  number  of  contracts  that  did  not  contain  Y2K 
compliance  language.  Also,  DoD  purchased  commercial  off-the-shelf 
information  technology  products  without  Y2K  compliance  testing. 

Compliance  Language.  Of  the  35  reviewed  contracts,  20  did  not  have  the 
required  FAR  Y2K  compliance  language  (see  Appendix  D).  DoD  ordered 
approximately  $195  million  of  information  technology  products  (during  the 
period  between  April  and  October  1997)  against  those  20  contracts  that  did  not 
have  the  required  FAR  language. 

We  were  told  some  of  the  contracts  that  did  not  have  the  required  language  were 
close  to  completion.  Contracting  officers  cited  several  reasons  for  the  delays  in 
implementing  the  required  language. 

•  Vendors  wanted  DoD  to  pay  additional  compensation  to  cover  the 
costs  of  determining  Y2K  compliance  in  their  products  and  to  offset 
the  increased  assumption  of  liability  if  their  products  failed. 

•  Vendors  that  had  informally  agreed  to  the  Y2K  language  in  DoD 
contracts  claimed  they  had  not  yet  received  assurance  from  all 
suppliers  as  to  Y2K  compliance  in  those  suppliers’  hardware  and 
software  products. 

•  DoD  purchasers  did  not  always  specify  that  information  technology 
hardware  and  software  items  had  to  be  Y2K  compliant  or  insist  that 
future  hardware  and  software  products  be  Y2K  compliant. 
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Implementing  Year  2000  Compliance 


Our  review  of  the  contract  files  showed  that  some  contracting  officers  had 
started  to  implement  the  required  language  shortly  after  the  directive  was  issued 
by  the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications, 
and  Intelligence)  in  May  1996.  Nevertheless,  for  the  most  part,  FAR 
requirements  and  DoD  policy  for  Y2K  contract  compliance  had  not  been 
implemented  effectively  or  in  a  timely  manner  by  Defense  Components. 

Compliance  Testing.  Of  the  35  reviewed  contracts,  none  required  testing  of 
purchased  products  to  ensure  that  the  products  offered  were  Y2K  compliant. 
Testing  would  be  a  certain  way  to  verify  Y2K  compliance,  however,  DoD 
requirements  for  testing  were  not  being  followed,  and  there  is  no  central  DoD 
organization  that  offers  such  testing. 

A  consulting  firm  that  specializes  in  testing  computers  for  Y2K  compliance, 
Greenwich  Mean  Time,  told  us  their  tests  showed  as  many  as  47  percent  of  the 
computers  tested  in  mid- 1997  were  not  fully  compliant.  Those  tests  were  based 
on  the  ability  of  the  computer’s  basic  input/output  system  to  recognize  and 
rollover  the  date  to  the  correct  year  and  correctly  interpret  the  year  2000  as  a 
leap  year.  Greenwich  Mean  Time  representatives  told  us  that  before  1997,  the 
failure  rate  was  as  high  as  93  percent. 

To  fix  noncompliant  computers,  agencies  can  update  the  basic  input/output 
system  of  each  computer  with  vendor-supplied  software.  Alternatively,  the  Air 
Force  has  developed  computer  software  that  may  be  used  during  startup  of  the 
computer  after  the  start  of  the  year  2000,  to  force  the  computer  to  accept  the 
correct  date^. 

Both  the  Army’s  Technology  Integration  Center  and  Greenwich  Mean  Time 
consultants  told  us  that  there  was  a  higher  risk  of  computer  failure  from  non¬ 
compliant  software  than  from  noncompliant  hardware.  Greenwich  Mean  Time 
representatives  tested  629  commercial  off-the-shelf  software  packages  that 
manipulate  dates.  The  tests  revealed  that  295  of  the  629  programs  store  dates 
differently  than  the  way  the  dates  were  entered  by  the  user,  113  of  the  programs 
did  not  recognize  the  year  2000  as  a  leap  year,  and  90  of  the  programs  tested 
would  not  work  after  December  31,  1999.  The  date-related  problems  included 
abnormal  program  termination  (known  as  general  protection  faults),  refusal  of 
the  software  to  run,  corruption  of  data,  and  inability  of  software  to  recognize 
vendor  license  information. 

During  the  audit,  we  found  that  the  Technology  Integration  Center  had  initiated 
testing  of  some  products  delivered  under  contracts  DAHC94-94-D-0005, 
F19630-93-D-0001,  and  N68939-95-D-0018;  but  that  no  testing  had  been 
performed  on  products  delivered  from  the  other  32  contracts  reviewed. 

Further,  while  each  of  the  DoD  testing  and  information  organizations  publicizes 
the  results  of  their  testing,  those  organizations  were  not  reporting  those  test 
results  to  the  General  Services  Administration.  See  Appendix  C  for  details. 


^  The  Air  Force  Y2K  software  is  available  for  download  from  internet 
address  <http://www.ssg.gunter.af.mil/Y2000> . 
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Implementing  Year  2000  Compliance 


We  believe  that  the  lack  of  consistent  testing  of  commercial  off-the-shelf 
computer  software  and  hardware  was  due  to  the  lack  of  compliance  with  DoD 
guidance  to  accomplish  that  testing.  DoD  needs  to  emphasize  its  requirements 
for  testing  newly-acquired  off-the-shelf  information  technology  products  for 
compliance  with  Y2K  requirements. 

Corrective  Action  Taken  by  Management.  Following  our  audit  results 
briefings  to  the  Acting  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  and  the  Director,  Defense  Procurement,  new 
guidance  was  drafted  by  those  offices.  The  guidance,  later  signed  by  the  Acting 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence),  requires  DoD  to  purchase  only  Y2K-compliant  equipment,  as  well 
as  requiring  testing  of  items  purchased  from  the  information  technology 
contracts  (see  Appendix  F).  Additionally,  the  Military  Departments  with 
contracts  lacking  compliance  language  began  action  to  get  that  language  into  the 
contracts.  Since  our  review,  the  Army  has  modified  its  last  contract  to  include 
that  language,  the  Navy  has  modified  the  remainder  of  its  contracts,  and  Air 
Force  has  modified  six  additional  contracts.  Three  Air  Force  contracts  still 
need  to  be  modified.  See  Appendix  E  for  further  details.  Because  the 
corrective  actions  taken  by  management  should  correct  the  problems  identified 
during  the  audit,  we  are  making  no  additional  recommendations  in  this  report. 


Effects  of  Noncompliance 

Without  the  required  Y2K  contract  language  and  without  agency  testing  of  the 
items  being  procured,  DoD  has  no  assurance  that  information  technology 
products  purchased  were  Y2K-compliant  and  there  is  no  contractor  obligation  to 
fix  the  noncompliant  items.  Additionally,  because  33  of  the  35  contracts  are 
available  for  use  by  other  Federal  agencies,  nonconforming  contract  items  can 
negatively  affect  the  ability  of  the  Federal  government  to  survive  the  Y2K 
crisis.  We  were  not  able  to  fully  assess  the  risk  of  receiving  noncompliant 
information  technology  products. 

Because  hardware  and  software  from  the  contracts  reviewed  may  be  integrated 
into  mission-critical  applications,  the  full  risk  of  having  non-Y2K-compliant 
information  technology  is  unknown.  However,  we  believe  that  the  purchase  of 
noncompliant  products  may  seriously  hamper  the  ability  of  DoD  to  perform  its 
administrative  and  warfighting  mission  requirements.  It  is  imperative  that  DoD 
take  aggressive  action  to  correct  this  problem  while  there  is  still  time. 


Management  Comments  and  Audit  Response 

A  draft  of  this  report  was  issued  on  January  15,  1998.  The  Under  Secretary  of 
Defense  for  Acquisition  and  Technology;  Ae  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and  Intelligence);  the  Services;  and  the 
Defense  Intelligence  Agency  were  invited  to  provide  optional  comments  on  the 
draft  report.  Comments  were  received  from  the  Office  of  Chief  Information 
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Implementing  Year  2000  Compliance 


Officer,  Navy  and  the  Deputy  Assistant  Secretary  (Contracting)  of  the  Office  of 
the  Assistant  Secretary  (Acquisition),  Air  Force.  See  Part  III  for  the  complete 
text  of  management  comments. 

Navy  Comments.  The  Office  of  the  Chief  Information  Officer,  Navy  provided 
documentation  showing  that  all  eleven  of  the  contracts  that  we  reviewed  are  now 
compliant  with  FAR  section  39.106  and  requested  that  we  modify  the  report  to 
reflect  the  subsequent  contract  modifications. 

Audit  Comments.  The  report’s  Executive  Sununary,  Part  I,  and  Part  II 
(Appendix  E,  Corrective  Actions  Taken  by  Management)  have  been  modified  to 
reflect  the  status  of  contract  compliance  with  Y2K  requirements  as  of 
February  6,  1998. 

Air  Force  Comments.  The  Deputy  Assistant  Secretary  (Contracting),  of  the 
Office  of  the  Assistant  Secretary  (Acquisition),  commented  that  the  frequent  use 
of  “required  Federal  Acquisition  Regulation  (FAR)  Year  2000  compliance 
clauses”  was  incorrect  since  there  are  no  Y2K  compliance  “clauses”  in  the 
FAR.  FAR  section  39.106,  “Year  2000  compliance,”  only  addresses  the 
“requirement”  to  acquire  Year  2000-compliant  information  technology.  Y2K 
compliance  is  a  “requirements”  issue  that  is  being  addressed  in  several  ways. 
Specifically,  Year  2000  compliance  requirements  are  being  captured  in 
statements  of  work  and  contract  specifications.  There  is  no  requirement  to 
include  a  compliance  “clause”  in  solicitations  and  contracts  for  the  acquisition 
of  information  technology.  The  Deputy  Assistant  Secretary  (Contracting) 
reconunended  that  the  report  be  revised  to  discuss  the  need  to  address  the 
“requirement”  for  Year  2000  compliance  and  not  “required  clauses.” 

Audit  Comments.  The  Deputy  Assistant  Secretary  (Contracting)  is  correct  that 
neither  DoD  guidance  nor  the  FAR  provision  contains  a  prescribed  “clause”  to 
be  included  in  solicitations  or  contracts.  Although  the  General  Services 
Administration  has  proposed  a  recommended  warranty  clause  for  use  by 
contracting  officers,  contracting  officers  are  given  broad  discretion  to  tailor 
clauses  that  meet  the  requirements  of  the  FAR  rule.  Additionally,  delivery 
orders  issued  against  indefinite  delivery /indefinite  quantity  contracts  could 
contain  such  provisions  should  the  underlying  contracts  fail  to  have  the  Y2K 
requirement.  To  make  our  report  clearer  in  this  regard,  we  have  changed  the 
word  “clause”  to  the  word  “language”  throughout  the  report. 
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Part  II  -  Additional  Information 


Appendix  A.  Audit  Process 


This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a 
listing  of  audit  projects  addressing  this  issue,  see  the  Y2K  webpage  on  IGnet 
<  ht^://www. ignet.gov  > 

Scope 

Audit  Work  Performed.  We  judgmentally  selected  to  review  35  DoD 
information  technology  contracts  for  commercial  off-the-shelf  products  (see 
Appendix  D).  The  35  reviewed  contracts  were  comprised  of  25  indefinite- 
delivery/indefinite-quantity  contracts  and  10  indefinite-delivery-requirement 
contracts  with  a  total  estimated  value  of  $13.9  billion.  The  review  included  7 
contracts  administered  by  the  Army,  11  Navy  contracts,  10  Air  Force  contracts, 
and  7  Defense  Intelligence  Agency  contracts.  The  Air  Force  contracts  included 
the  Defense  Messaging  System  contract  that  was  administered  by  the  Air  Force 
on  behalf  of  the  Defense  Information  Systems  Agency. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  the  DoD,  General  Service  Administration’s  Government 
Information  Technology  Executive  Coimcil  and  MITRE  Corporation.  Further 
details  are  available  on  request. 

Methodology.  We  reviewed  contract  files,  evaluated  vendor  representations, 
and  talked  to  Y2K  compliance  offices  established  by  the  Services.  We  also 
reviewed  information  technology  acquisitions  for  commercial  off-the-shelf 
products  made  from  the  35  contracts  since  April  1997. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  program  audit  from 
July  1997  to  November  1997.  The  audit  was  made  in  accordance  with  auditing 
standards  issued  by  the  Comptroller  General  of  the  United  States,  as 
implemented  by  the  Inspector  General,  DoD.  We  did  not  use  statistical 
sampling  procedures. 
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Appendix  B.  Summary  of  Prior  Audits  and 
Other  Reviews 


General  Accounting  Office 

The  General  Accounting  Office  (GAO)  has  conducted  several  audits  related  to 
Y2K  issues.  The  audits  relevant  to  this  report  are  summarized  below. 

GAO  Report  No.  AIMD-98-35  (OSD  Case  No.  1456),  “Defense  Computers: 
Air  Force  Needs  to  Strengthen  Year  2000  Oversight,”  January  16, 1^8. 

This  was  a  Congressionally  requested  review  of  the  Air  Force’s  Y2K  program. 
The  review  focused  on  Air  Force  oversight  of  it's  Y2K  program  and  the 
appropriateness  of  the  Air  Force  strategy  and  actions  for  ensuring  that  the 
problem  will  be  successfully  addressed.  The  Air  Force  has  taken  a  number  of 
positive  actions  toward  fulfilling  its  Y2K  oversight  responsibilities.  At  the  same 
time,  the  Air  Force  has  not  yet  adequately  addressed  several  critical  issues  that 
would  ensure  that  it  is  well-positioned  to  deal  with  the  later,  and  more  difficult, 
phases  of  Y2K  correction.  GAO’s  review  revealed  that  some  Components  are 
not  adequately  planning  for  the  testing  phase  of  their  Y2K  effort  and  developing 
of  contingency  plans.  GAO  also  found  that  some  Components  are  taking 
conflicting  approaches  toward  determining  the  actual  impact  or  the  program 
status  to  their  system  interfaces.  If  Components  and  the  Air  Force  do  not 
promptly  address  and  take  consistent  action  on  these  issues,  they  may  well 
negate  any  success  they  may  have  in  making  systems  within  their  control 
Y2K  compliant.  While  the  Air  Force  has  enlisted  the  help  of  the  Air  Force 
Audit  Agency  to  help  address  some  of  these  concerns,  this  work  needs  to  be 
backed  by  comprehensive  and  continued  Air  Force  oversight  in  order  to  ensure 
that  it  can  address  unforeseen  problems  and  delays  in  the  next,  more  difficult 
phase. 

GAO  Report  No.  AIMD-98-7R  (OSD  Case  No.  1471),  “Defense  Computers: 
Technical  Support  Is  Key  to  Naval  Supply  Year  2000  Success,”  October  21, 
1997,  states  that  Naval  Supply  Systems  Command  had  not  allocated  sufficient 
resources  to  the  Fleet  Material  Support  Office  Year  2000  Project  Office  to 
ensure  that  all  system  interfaces  were  identified  and  adequately  monitored  for 
progress.  Also,  Naval  Supply  Systems  Command  had  not  directed  that  risk 
assessments  be  performed  or  that  contingency  plans  be  prepared  at  the  system 
and  functional  levels.  As  a  result  of  the  concerns  raised.  Naval  Supply  Systems 
Command  and  Fleet  Material  Support  Office  officials  began  addressing  system 
interface  issues  by  assigning  full-time  staff  to  identify  date-related  data  elements 
in  interface  files  and  ensure  that  date  formats  are  compatible.  Those  actions, 
together  with  Naval  Supply  Systems  Command’s  plans  for  requiring  system 
managers  to  perform  risk  assessments  and  develop  contingency  plans  for  critical 
systems,  should  help  mitigate  against  the  loss  of  operational  capability  at  the 
start  of  the  year  2000.  As  Naval  Supply  Systems  Command  progresses  to  the 
renovation,  validation  (testing),  and  implementation  phases  of  the  Year  2(X)0 
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program;  continued  attention  to  these  issues  will  be  necessary  to  better  ensure 
that  the  Year  2000  challenge  is  met.  The  Department  of  Defense  concurred 
with  a  draft  of  this  report. 

General  Accounting  Office  Report  No.  AIMD-97-149  (OSD  Case  No.  1446), 
“Defense  Computers:  Logistics  Systems  Support  Center  Needs  to  Confront 
Significant  Year  2000  Issues,”  September  26,  1997.  The  report  states  that 
while  Y2K  improvement  efforts  have  been  initiated  by  Logistics  Systems 
Support  Center  on  its  Commodity  Command  Standard  System  program,  several 
key  project  management  actions  associated  with  the  assessment  phase  have  not 
been  completed.  As  a  result,  Logistics  Systems  Support  Center  is  not  presently 
well  positioned  to  move  forward  to  the  more  difficult  phases  of  renovation, 
validation,  and  implementation  in  the  Y2K  process  phases  that  industry  experts 
estimate  could  consume  as  much  as  three-fourths  of  Y2K  project  time  and 
resomces.  The  report  recommended  that  Logistics  Systems  Support  Center  still 
needs  to  take  a  number  of  actions  to  increase  its  chances  of  success,  including 
(1)  managing  competing  workload  priorities,  (2)  planning  for  testing,  (3) 
clarifying  and  coordinating  written  system  interfoce  agreements,  and  (4) 
developing  a  contingency  plan.  To  increase  its  chances  of  successfully 
managing  its  Y2K  program.  Logistics  Systems  Support  Center  will  also  need  to 
institutionalize  a  repeatable  software  change  process  that  can  be  used  from 
project  to  project.  Given  the  prominence  of  date  processing  in  the  Commodity 
Command  Standard  System  and  its  central  mission  of  sustaining  the  solider  in 
the  field.  Logistics  Systems  Support  Center  cannot  afford  to  delay  any  longer, 
and  needs  to  demonstrate  that  it  will  perform,  all  the  key  actions  associated  with 
sound  Y2K  planning  and  management.  The  Director,  Test,  Systems 
Engineering  and  Evaluation,  concurred  with  a  draft  of  this  report. 

General  Accounting  Office  Correspondence  Report  No.  AIMD-97-120R 
(OSD  Case  No.  1399),  “Defense  Computers:  Standard  Systems  Group 
Needs  to  Sustain  Year  2000  Progress,”  August  19,  1997.  The  report  states 
that  Standard  Systems  Group  must  further  emphasize  management  and  oversight 
of  system  interfaces  to  ensure  successful  implementation  of  year  2000-compliant 
system  throughout  its  user  community.  Also,  a  number  of  Standard  Systems 
Group  systems  must  use  standard  interface  message  formats  to  exchange  data 
that  are  defined  by  external  entities  not  under  Standard  Systems  Group’s 
control.  Some  of  the  message  formats  had  not  been  finalized  by  the 
organizations  responsible  for  their  definition.  Recently,  Standard  Systems 
Group’s  Year  2000  Project  Office  officials  began  addressing  the  interface  issue. 
If  effectively  implemented  by  the  project  office,  this  effort  should  be  a  positive 
step  toward  preventing  loss  of  operational  capabilities  between  Standard 
Systems  Group’s  internal  and  external  system  interface  message  fonnats  at  the 
year  2000.  The  Air  Force  Director,  Communications  and  Information, 
concurred  with  a  draft  of  this  report. 

GAO  Report  No.  AIMD-97-112  (OSD  Case  No.  1395),  “Defense 
Computers:  Improvements  to  DoD  Systems  Inventory  Needed  for 
Year  2000  Effort,”  August  13,  1997,  states  that,  while  improvement  efforts 
have  been  initiated,  the  Defense  Integration  Support  Tools  database  will  not  be 
usable  and  reliable  in  time  to  have  a  beneficial  impact  on  Y2K  correction 
efforts.  The  Defense  Integration  Support  Tool  contains  the  DoD  enterprise- 
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wide  inventory  of  automated  information  systems.  The  report  recommended 
investigation  of  all  duplicate,  inactive,  and  incomplete  entries;  expedited 
development  and  implementation  of  the  purging  methodology;  and  expansion  of 
information  contained  in  the  database  for  individual  systems,  to  include  key 
program  activity  schedules  that  managers  of  interfacing  systems  need  to  ensure 
that  system  interfaces  are  maintained  during  the  renovation  phase.  The 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  concurred  with  the  recommendations  and  stated  that  DoD  plans  to 
take  corrective  action  by  performing  statistical  sampling  of  the  Defense 
Integration  Support  Tools  Database  to  validate  accuracy. 

GAO  Report  No.  AIMD-97-106  (OSD  Case  No.  1389),  “Defense 
Computers:  Issues  Confronting  Defense  Logistics  Agency  in  Addressing 
Y2K  Problems,”  August  12,  1997,  states  that  the  Defense  Logistics  Agency 
has  already  assessed  the  Y2K  impact  on  its  operations;  inventoried  its  systems; 
conducted  pilot  projects  to  determine  Y2K  effects  on  some  of  its  major  systems; 
and  developed  and  issued  policies,  guidelines,  standards,  and  recommendations 
on  Y2K  correction  for  the  agency.  The  Defense  Logistics  Agency  has  not 
prioritized  the  86  automated  information  systems  it  plans  to  have  operational  in 
the  year  2000  to  ensure  that  mission  critical  systems  are  corrected  first.  In 
addition,  the  Defense  Logistics  Agency  has  not  developed  contingency  plans  in 
the  event  that  any  of  the  systems  cannot  be  corrected  on  time.  The  report 
recommended  that  the  Defense  Logistics  Agency  complete  signed,  written 
interface  agreements  detailing  data  exchange  methods;  develop  a  Y2K  system 
prioritization  plan;  and  prepare  contingency  plans  for  all  critical  systems.  The 
Under  Secretary  of  Defense  for  Acquisition  and  Technology  concurred  with  the 
recommendation  on  interface  agreements  and  contingency  plans  but  did  not 
concur  with  the  recommendation  on  system  prioritization,  stating  that  the 
Defense  Logistics  Agency’s  planning  efforts  and  strategy  for  renovating  its 
systems  are  adequate.  The  Defense  Logistics  Agency  is  in  the  process  of 
ensuring  that  documented  agreements  are  prepared  for  all  interfaces  requiring 
changes  between  their  interface  partners.  Completion  was  expected  in 
September  1997.  The  Defense  Logistics  Agency  is  also  in  the  process  of 
preparing  contingency  plans  within  each  business  area  focusing  on  those  systems 
that  Y2K  will  affect.  Initial  plans  were  to  be  prepared  by  October  1997. 

GAO  Report  No.  AIMD-97-117  (OSD  Case  No.  1392),  “Defense 
Computers:  Defense  Finance  and  Accounting  Service  Faces  Challenges  in 
Solving  the  Y2K  Problems,”  August  11,  1997,  states  that  the  Defense  Finance 
and  Accounting  Service  has  developed  a  Y2K  strategy  consistent  with  the  DoD 
Y2K  Management  Plan  and  has  defined  conditions  that  automated  information 
systems  must  meet  to  obtain  certification  as  Y2K  compliant.  However,  the 
Defense  Finance  and  Accounting  Service  has  not  identified  all  critical  tasks  for 
achieving  Y2K  objectives,  established  milestones  for  completing  all  tasks, 
performed  formal  risk  assessments  of  all  systems  to  be  renovated,  or  prepared 
contingency  plans  in  the  event  that  renovations  are  not  completed  in  time  or  fail 
to  operate  properly.  The  report  also  states  that  the  Defense  Finance  and 
Accounting  Service  has  not  identified  all  system  interfaces  and  has  completed 
only  230  of  904  written  agreements  with  interface  partners.  Further,  the 
Defense  Finance  and  Accounting  Service  has  not  adequately  ensured  that  testing 
resources  will  be  available  to  determine  if  all  operational  systems  are  compliant 
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before  the  year  2000.  The  report  recommended  that  the  Defense  Accounting 
and  Finance  Service  identify  Y2K  program  actions  and  milestones,  issue 
guidance  on  ensuring  continuity  of  operations,  identify  external  interfaces  and 
obtain  written  agreements  describing  the  method  of  data  exchange,  and  devise  a 
testing  schedule  to  ensure  that  all  systems  can  operate  in  a  Y2K  environment. 
The  Under  Secretary  of  Defense  (Comptroller)  concurred  with  the 
recommendations.  The  Defense  Finance  and  Accounting  Service  agreed  to 
update  its  existing  Year  2000  Executive  Plan  and  it's  Corporate  Contingency 
Plan.  It  also  agreed  to  have  all  written  interface  agreements  with  interface 
partners  in  place  by  September  30,  1997,  and  to  fully  implement  its  Y2K 
certification  process  for  ensuring  that  all  systems  are  compliant.  Further,  the 
Defense  Finance  and  Accounting  Service  agreed  to  devise  a  testing  schedule  that 
identified  the  test  facilities  and  resources  needed  for  performing  proper  testing 
of  its  systems  in  a  Y2K  environment. 


Appendix  C.  Other  Matters  of  Interest 


We  identified  some  Government  organizations  that  can  provide  testing  services 
or  information  on  Y2K  compliance.  For  example: 

•  The  Federal  Chief  Information  Officers  Council  Subcommittee  on  the  Y2K 
Commercial  Off-the-shelf  Workgroup  developed  an  internet-based  database 
of  Y2K  compliant  products.  The  database  is  known  as  the  Federal  Y2K 
COTS  Product  Database.  The  database  contains  agency  experiences  and 
notations  on  specific  products,  vendor  information,  and  details  on  Y2K 
compliance.  The  system  was  jointly  developed  by  representatives  from 
Social  Security  Administration  and  the  General  Services  Administration. 

•  The  Army  Information  Systems  Engineering  Command  (Technology 
Integration  Center)  maintains  a  database  that  shows  commercially  available 
information  technology  products  that  have  been  tested  for  Y2K  compliance. 
The  U.  S.  Army  Materiel  Command  also  maintains  a  list  of  computers  that 
are  Y2K  compliant  or  non-compliant. 

•  The  MITRE  corporation  and  Air  Force  Electronic  Systems  Center  have  a 
database  that  is  updated  by  the  contractors  to  show  their  products’  Y2K 
compliance. 

While  each  of  the  DoD  testing  and  information  organizations  publicizes  the 
results  of  their  testing  through  internet  web  sites^  those  organizations  were  not 
reporting  the  test  results  to  the  Federal  Y2K  COTS  Product  Database.  We 
believe  that  DoD  testing  centers  need  to  establish  procedures  for  reporting  then- 
test  results  to  the  Federal  Y2K  COTS  Product  Database.  This  database,  when 
used  as  a  central  repository  for  Government- wide  testing  results,  could  preclude 
duplication  of  testing  efforts. 


^  Respective  internet  addresses  are  <http://y2k.policyworks.gov> , 

<  http :  //WWW .  hqisec .  army .  mil/y 2kweb  > ,  and 

<  http :  //WWW .  mitre .  org/research/y2k  > . 
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*  Contract  Types  are  IDIQ  (Indefiniie-Delivery/Indefmite-Quantity)  and  IDR  (Indefinite  Delivery 
Requirement) 


Appendix  D.  Results  of  Information  Technology  Contracts  for  Commercial  Off-The-Shelf  Products  Reviewed 
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*  Contract  Types  arc  IDIQ  (Indefinite-Delivery /Indefinite-Quantity)  and  IDR  (Indefinite  Delivery 
Requirement) 


Appendix  E.  Corrective  Actions  Taken  by 
Management 

At  the  conclusion  of  our  audit,  we  briefed  the  Acting  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence);  the  Director, 
Defense  Procurement;  and  representatives  from  the  Services,  Defense 
Information  Systems  Agency,  and  the  Defense  Intelligence  Agency  on  the 
results  of  our  audit.  The  Acting  Assistant  Secretary  was  greatly  concerned  that 
the  level  of  compliance  was  not  higher  since  a  previous  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence)  memorandum, 
“Year  2000  Computing  Problem  with  Personal  Computers  and  Workstations,” 
May  8,  1996,  had  directed  DoD  Components  to  issue  stop  work  orders  on  all 
contracts  for  new  products  that  fail  to  meet  the  Y2K  requirement.  Following 
our  briefing,  the  Acting  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  and  the  Director,  Defense  Procurement 
began  drafting  new  guidance  to  DoD  Components  requiring  Y2K-compliant 
information  technology  and  emphasizing  testing  requirements  for  items 
purchased  from  the  information  technology  contracts.  We  have  included  final 
guidance  resulting  from  these  efforts  as  Appendix  F.  Additionally,  as  shown  in 
the  table  below;  Army,  Navy,  and  Air  Force  Contracting  Offices  have 
completed  the  required  contract  modifications  on  17  additional  contracts. 

Status  of  Contracts  Compliant  with  Federal  Acquisition 
Regulation  39.106  as  of  February  6,  1998 


At  End  of 
Audit 

Component  Field  Work 

Army  6 

Navy  ^  1 

Air  Force  1 

Defense  Intelligence  Agency  7 


Total  15 


Subsequent 

Contract 

Modifications 

Remaining 

Noncompliant 

Contracts 

Total 

Contracts 

1 

0 

7 

10 

0 

11 

6 

3 

10 

0 

0 

7 

17 

3 

35 
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Appendix  F.  Assistant  Secretary 
Of  Defense  (Command,  Control, 
Communications,  and  Intelligence) 
Memorandum 


ASSISTANT  SECRETARY  Or  DEFENSE 
6000  DEFENSE  PENTAGON 
WASHINGTON*  DC  20301.0000 

December  18,  1997 


:0*4MAND.  COMTnOL. 
OMMUNICAriONS.  ANO 
iMTck.uocNce 


MEMORANDUM  FOR  SECRETARIES  OF  THE  MILITARY  DEPARTMENTS 
DIRECTORS  OF  THE  DEFENSE  AGENCIES 

SUBJECT:  Acquisition  of  Year  2000  <Y2K)  Compliant 

Information  Technology  <IT)  and  Bringing  Existing 
IT  into  Compliance 


Effective  immediately,  all  IT  that  is  acquired  fyy  the 
Military  Departments  and  Defense  Agencies  shall  be  Y2X 
compliant.  This  includes  IT  acquired  for  use  in  national 
security  systems  as  defined  in  Federal  Acquisition 
Regulation  (FAR)  Part  39.002,  and  applies  to  all  Department 
of  Defense  (DoD)  purchases  by  any  acquisition  method, 
including  orders  placed  under  contracts  or  schedules  issued 
by  other  Agencies.  Information  technology  contracts  and 
other  acquisition  instruments  must  hp  reviewed  on  a  case  by 
case  basis  to  determine  whether  any  modification  to  the 
contract  or  other  acquisition  instriament  is  necessary. 

Orders  for  IT  shall  not  be  placed  against  a  contract  or 
other  acquisition  instrument  unless  that  contract /instrument 
requires  Y2K  compliance  or  the  order  itself  requires  Y2K 
conqpl  lance. 

Either  the  supplier  or  the  acquiring  activity  will  teat 
at  least  a  representative  sampling  of  the  IT  that  is 
delivered  and  document  the  results  in  writing. 

The  term  'Year  2000  compliant'  is  defined  at  FAR  Part 
39.002  as  follows: 

'‘Year  2000  con^liant  means,  information 
technology  that  accurately  processes  date /time 
data  (including,  but  not  limited  to,  calculating, 
comparing  and  sequencing)  from,  into,  and  between 
Che  twentieth  and  twenty-first  centuries,  and  the 
years  1999  and  2000  and  leap  year  calculations. 
Furthermore,  Year  2000  compliant  information 
technology,  when  used  in  combination  with  other 
information  technology,  shall  accurately  process 
date/ time  data  if  the  other  information  technology 
properly  exchanges  dace/time  data  with  it.' 

a 
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Appendix  F.  Assistant  Secretary  Of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  Memorandum _ 


Requests  for  exceptions  to  this  policy  must  be 
submitted  to  the  Department  of  Defense  Chief  Information 
Officer  (DoD  CIO)  for  approval. 

For  IT  in  the  existing  inventory  that  is  not  Y2K 
compliant,  DoD  Components  should,  in  appropriate  cases,  be 
assertive  in  requesting  that  the  supplier  and  the 
manufacturer  take  action  to  bring  the  IT  into  compliance. 

Requests  for  waivers  to  this  policy  and  questions 
concerning  this  policy  should  be  submitted  to  Mr.  Samuel 
Worthington,  Director  of  Information  Technology  or  his 
Deputy,  Ms  Ruby  Harney,  Office  of  the  Assistant  Secretary  of 
Defense  (C31} ,  Room  3D239.  6000  Defense  Pentagon,  Washington 
D.C.,  20301-6000.  Mr.  Worthington  can  be  reached  on 
(703)  614-6132,  (email;  WorthinS9osd.pentagon.mil)  . 

Ms.  Harney  can  be  reach  be  reached  on  (703)  614-6202, 

(email:  ruby.harney9osd.pentagon.mil)  . 
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Appendix  G.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Procurement 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 
Chief  Information  Officer 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 
Chief  Information  Officer 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Assistant  Secretary  of  the  Air  Force  (Acquisition),  SAF/AQ 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Intelligence  Agency 
Director,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
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Appendix  G.  Report  Distribution 


Non-Defense  Federal  Organizations 

Federal  Chief  Information  Officers  Council  Subcommittee  on  Year  2000 
Office  of  Management  and  Budget 

Office  of  Federal  Procurement  Policy,  Office  of  Management  and  Budget 
Office  of  Information  and  Regulatory  Affairs,  Office  of  Management  and  Budget 
Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Conunittee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Conunittee  on  Armed  Services 

Senate  Subcommittee  on  Acquisition  and  Technology,  Conunittee  on  Armed 
Services 

Senate  Committee  on  Governmental  Affairs 
House  Conunittee  on  Appropriations 

House  Subcommittee  on  National  Security,  Conunittee  on  Appropriations 
House  Conunittee  on  Government  Reform  and  Oversight 

House  Subconunittee  on  Government  Management,  Information,  and  Technology, 
Conunittee  on  Government  Reform  and  Oversight 
House  Subconunittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 

House  Subconunittee  on  Military  Procurement,  Committee  on  National  Security 
House  Committee  on  Science 

House  Subconunittee  on  Technology,  Committee  on  Science 
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Part  III  -  Management  Comments 


Department  of  the  Navy  Comments 


DEPARTMENT  OF  THE  NAVY 

OFFICE  OF  THE  CHIEF  INFORMATION  OFFICER 
1225  JEFFERSON  DAVIS  HIGHWAY 
ARLINGTON,  VA  22202-431  I 


26  Jan  1998 


From;  Department  of  the  Navy  Chief  Information  Officer 

To:  Department  of  Defense  Inspector  General,  400  Army  Navy  Drive, 

Arlington,  VA  22202-2884  (Attn:  Mr.  Paul  J.  Granetto,  Director, 
Contract  Management  Directorate) 

Subj:  DRAFT  AUDIT  REPORT  ON  DOD  INFORMATION  TECHNOLOGY  SOLICITATIONS  AND 
CONTRACT  COMPLIANCE  FOR  YEAR  2000  REQUIREMENTS  (PROJECT  NO.  7CA- 
0052) 


Ref:  (a)  Your  Memo  of  15  Jan  98 


End : 


(1)  Modification  P00044  to  Supermini  Contract  F19630-93-D-0001 
dtd  31  Oct  97 

(2)  Modification  P00016  to  TAC-4  Contract  N88939-95-D-0004  dtd 
17  Dec  97 

(3)  Modification  P00025  to  PC-LAN+  Contract  N68939-95-D-0018  dtd 
25  Nov  97 

(4)  Modification  POO 08 8  to  CAD  II  Contract  N66032-93-D-0021  dtd 
13  Nov  97 

(5)  Modification  P00047  to  CAD  II  Contract  N66032-94-D-0012  dtd 

12  Nov  97 

(6)  Modification  P00151  to  CAD  II  Contract  H66 032 -91-D- 0003  dtd 

13  Nov  97 

(7)  Modification  P00021  to  Data  Base  Machines  Contract  F19628-93- 
D-0018  dtd  12  Nov  97 

(8)  Modification  P00033  to  Data  Base  Machines  Contract  F19628-93- 
D-0019  dtd  21  Nov  97 

(9)  Modification  P00028  to  Data  Base  Machines  Contract  F19628-93- 
D-0028  dtd  10  Nov  97 

(10)  Modification  P00014  to  NALCOMIS  Contract  N66032-93-D-0001  dtd 
20  Jan  98 


1-  Reference  (a)  forwarded  the  subject  draft  report  for  review  and 
comment.  We  recommend  revisions  to  the  report  to  reflect  the  current 
status  of  the  eleven  Navy  contracts  reviewed  for  compliance  with  Federal 
Acquisition  Regulation  (FAR)  39.106. 


2.  As  of  January  16,  1998,  contract  modifications  to  incorporate  the 
Year  2000  requirement  had  been  issued  to  an  additional  nine  of  the 
eleven  contracts.  With  the  modification  of  the  NALCOMIS  contract  on 
January  20,  1998,  all  eleven  Navy  contracts  are  compliant  with  FAR 
39,106.  Enclosures  (1)  through  (10)  are  provided  for  your  files. 

3 .  When  necessary,  the  contract  modifications  identify  specific 
Contract  Line  Item  Numbers  (CLINs)  which  are  no  longer  available  for 
ordering.  Also,  since  the  draft  report  was  prepared,  the  hardware  and 
software  ordering  period  of  the  TAC-4  contract  has  eaqjired. 

Modification  P00016  to  the  TAC-4  contract,  which  added  the  Year  2000 


Department  of  the  Navy  Comments 


Stibj  ;  DRAFT  AUDIT  REPORT  ON  DOD  INFORMATION  TECHNOLOGY  SOLICITATIONS  AND 
CONTRACT  COMPLIANCE  FOR  YEAR  2000  REQUIREMENTS  (PROJECT  NO.  7CA-0052) 

requirement,  excluded  CLINs  for  which  there  had  been  no  orders  (e.g., 
zero  demand)  during  the  contract  life.  Therefore,  during  the  remaining 
ordering  period  of  the  TAC-4  contract,  all  delivery  orders  were  screened 
by  the  project  office  and  contracting  officer  to  ensure  that  these 
excluded  CLINs  were  not  purchased. 

4.  Based  on  this  current  information,  the  sections  of  the  report 
entitled  "Corrective  Action  by  Management"  found  on  page  ii  of  the 
Executive  Summary,  on  page  6  of  Part  I,  and  in  Part  II  Appendix  E, 
should  state  that  all  Navy  contracts  identified  in  the  report  are 
compliant . 

5.  The  DON  CIO  point  of  contact  for  this  response  is  Mr.  Floyd  V. 

Groce.  He  can  be  reached  at  (202)  433>3932  or  e>mail 
floyd.groce®nismc.  navy,  roil. 


VALERIE  E.  HALLXCK 
By  direction 
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Department  of  the  Air  Force  Comments 


DEPARTMENT  OF  THE  AIR  FORCE 


WASHINGTON  DC 


OFFICE  OF  THE  ASSISTANT  SECftrTARY 


Z  S  JAN  m 


MEMORANDUM  FOR  ASSISTANT  INSPECTOR  GENERAL  FOR  AUDITING 
OFFICE  OF  THE  INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 

FROM:  SAF/AQC 

1060  Air  Force  Pentagon 
Washington,  DC  20330-1060 

SUBJECT:  DoDIG  Draft  Report,  DoD  Information  Technology  Solicitations  and  Contract 
Compliance  for  Year  2000  Requirements  (Project  No.  7CA-0052),  (Your  Memo 
15  Jan  98) 

Your  memorandum  requested  the  Assistant  Secretary  of  the  Air  Force  (Financial 
Management  and  Comptroller)  provide  comments  on  the  Draft  Audit  Report  on  DoD 
Information  Technology  Solicitations  and  Contract  Compliance  for  Year  2000  Requirements, 
Project  No.  7CA-0052. 

Throughout  the  entire  audit  report  reference  is  made  to  and  recommendations  address  the 
use  of  “required  Federal  Acquisition  Regulation  (FAR)  Year  2000  compliance  clauses.”  There 
are  no  Year  2000  compliance  “clauses”  in  the  FAR.  FAR  Part  39.106,  Year  2000  compliance, 
only  addresses  the  “requirement”  to  acquire  Year  2000  compliant  information  technology.  Year 
2000  compliance  is  a  “Requirements”  issue  that  is  being  addressed  in  several  ways.  Specifically, 
Year  2000  compliance  Requirements  are  being  captured  in  Statements  of  Work  and  contract 
Specifications.  There  is  no  requirement  to  include  a  compliance  “clause”  in  solicitations  and 
contracts  for  the  acquisition  of  information  technology.  We  recommend  that  the  audit  report  be 
revised  to  discuss  the  need  to  address  the  “requirement”  for  Year  2000  compliance  and  not 
“required  clauses.” 

We  appreciate  the  opportunity  to  comment  on  this  draft  report.  If  you  should  have  any 
questions,  please  a  call  my  action  officer,  Lt  Col  Bill  McNally,  SAF/AQCP,  DSN  425-7061  or 
Comm  (703)  588-7061. 


-FRANK  J.^DERSON,  JR.,  B/g  Gen,  USAF 
Deputy  Assistant  Secretary  (Contracting) 
Assistant  Secretary  (Acquisition) 


SAF/FMPF 


Golden  Legacy,  Boundless  Future.,.  Your  Nation*s  Air  Force 
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Audit  Team  Members 


The  Contract  Management  Directorate,  Office  of  the  Assistant  Inspector 
General  for  Auditing,  DoD,  produced  this  report. 

Paul  J.  Granetto 
Kimberley  A.  Caprio 
Robert  M.  Murrell 
Kent  E.  Shaw 
Johnetta  R.  Colbert 
Young  J.  Jin 
Robert  E.  Beets 
William  C.  Coker 
Awanda  A.  Grimes 
Donna  L.  Starcher 
Ana  M.  Myrie 


